Privacy Policy

Effective: April 16, 2026  ·  Last updated: April 16, 2026

1. Who We Are

NoraRx is a Canadian telehealth platform that connects patients with BC-licensed nurse practitioners for online prescription services. References to "NoraRx," "we," "us," or "our" refer to the business operating at norarx.com, based in British Columbia, Canada.

We are subject to the Personal Information Protection and Electronic Documents Act (PIPEDA) and BC's Personal Information Protection Act (PIPA) for the personal and health information we collect from our patients.

2. Information We Collect

Information you provide directly

• Identity: First and last name, date of birth, city of residence, phone number, email address.
• Government ID photo: An image of your driver's licence, health card, or passport used solely to verify your identity for prescription purposes. This photo is transmitted securely to your assigned nurse practitioner and is not stored on our servers.
• Clinical intake: Your condition, symptoms, medical history, current medications, allergies, and other health details you provide during intake. This constitutes personal health information under PIPA.
• Account credentials: Your email and a bcrypt-hashed password. We never store passwords in plain text.
• Payment: Processed entirely by Stripe, Inc. NoraRx never sees or stores your credit card number — we receive only a payment confirmation and any promotional code used.

Information collected automatically

• Standard server logs: IP address, browser type, pages visited, referring URL. Retained up to 30 days for security purposes.
• A single server-side session cookie to keep you logged into your patient portal. This cookie expires when you log out or close your browser. We do not use advertising cookies or third-party trackers.

What we do not collect

• We do not use Google Analytics, Facebook Pixel, or any third-party advertising trackers on intake or portal pages.
• We do not collect information from anyone under 19 years of age.

3. How We Use Your Information

• To deliver care: Your intake is shared with your assigned BC-licensed nurse practitioner so they can review your case and issue a prescription if appropriate.
• To fill your prescription: Your name and pharmacy preference are included in the prescription transmitted to your BC pharmacy.
• To communicate with you: We send transactional emails (intake confirmation, account activation, prescription status) via Resend. We do not send marketing emails without your explicit consent.
• To comply with the law: We retain clinical records as required under BC health records regulations and professional licensing standards.
• To improve our service: Aggregate, de-identified usage patterns may be reviewed internally to improve clinical protocols and intake flow.

4. How We Share Your Information

We do not sell, rent, or trade your personal information. We share it only in these limited circumstances:

• Nurse practitioners: Your assigned NP receives your full intake. NPs are bound by professional regulatory obligations under BCCNM regarding confidentiality.
• Pharmacies: Prescription details are sent electronically to your chosen BC pharmacy.
• Service providers (sub-processors):
  • Stripe, Inc. — payment processing
  • Resend, Inc. — transactional email
  • HostGator / Newfold Digital — web hosting
  Each sub-processor operates under a data processing agreement.
• Legal requirements: We may disclose information if required by law, court order, or where necessary to protect the safety of a patient or third party.

We never share your information with insurance companies, employers, data brokers, or analytics vendors.

5. Data Storage and Security

Patient data is hosted by HostGator (Newfold Digital), whose primary infrastructure is located in the United States. Under PIPEDA section 4.1.3, NoraRx remains accountable for your personal information even when processed or stored by a third party outside Canada. We have taken steps to ensure HostGator maintains security standards consistent with PIPEDA. We apply the following additional safeguards:

• HTTPS/TLS encryption for all data in transit
• Passwords stored as bcrypt hashes — never plain text
• Database access restricted to application credentials only
• Government ID images transmitted directly to NP, not persisted in our database
• Password reset tokens expire within 1 hour of issue

No system is perfectly secure. In the event of a breach that creates real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as required under PIPEDA.

6. Data Retention

We retain patient intake and clinical records for a minimum of 10 years from the date of last service, as required by BC health records regulations. You may request deletion of your account at any time; however, we may be legally required to retain certain clinical records even after deletion.

• Financial/billing records: 7 years (tax and audit requirements)
• Server access logs: 30 days

7. Your Rights

Under PIPEDA and BC PIPA, you have the right to:

• Access — request a copy of the personal information we hold about you
• Correction — request that inaccurate information be corrected
• Deletion — request deletion of your account and non-mandatory records
• Withdraw consent — for non-essential uses; note this may affect our ability to deliver services
• Complaint — with the Office of the Privacy Commissioner of Canada (priv.gc.ca) or BC's Information and Privacy Commissioner (oipc.bc.ca)

To exercise any right, email hello@norarx.com. We will respond within 30 days.

8. Children's Privacy

NoraRx is for adults 19 years of age or older (BC age of majority). We do not knowingly collect information from minors. If you believe a minor has submitted information, contact us immediately at hello@norarx.com.

9. Changes to This Policy

If we make material changes, we will update this page with a new effective date and, where appropriate, notify registered patients by email. Continued use of NoraRx after changes are posted constitutes acceptance of the updated policy.

10. Contact

For privacy questions, requests, or concerns:

Email: hello@norarx.com
Location: British Columbia, Canada